Data sanitization system for public host platform

ABSTRACT

The example embodiments are directed to a system and method for managing blockchain transaction processing. In an example, the method includes one or more of receiving a message transmitted from a client device, the message including a predefined structural format for processing by a service providing computing system, determining a type of the message and detecting one or more sensitive fields within the message based on the determined type of the message, anonymizing values of the one or more sensitive fields within the message while leaving the predefined structural format intact, and transmitting the anonymized message including the one or more anonymized values with the predefined structural format remaining intact to the service providing computing system. The system can anonymize data from a private network before it is transmitted to a public service.

TECHNICAL FIELD

This application generally relates to a data sanitization system andmore particularly, to a system, method, and non-transitory computerreadable medium which anonymize sensitive client information from amessage while leaving a data structure of the message intact includingnon-sensitive information thereby allowing the client data to beprocessed anonymously by a third party service.

BACKGROUND

Public cloud services are a form of cloud computing in which anorganization relies on a third-party cloud service provider for servicessuch as servers, data storage, applications, enterprise computations,and the like, which are delivered to the organization through theInternet. Public cloud services can free companies from the expensivecosts of having to purchase, manage and maintain their own on-premiseshardware and software infrastructure. Public clouds are also deployedsignificantly faster and with more scalability and accessibility thanon-premises infrastructure as a result of the public cloud provider'sexpertise and existing infrastructure. Organization are even able todevelop their own applications while having the applications hosted bythe public cloud.

However, public cloud services are typically provided by third partiesgiving these third parties access to sensitive information of theorganization and its members. The sensitive information includespersonally identifiable information (PII) which is any information aboutan individual (or a user device associated with the individual) whichcan be used to distinguish or trace the individual's identity. PII isoften exploited by criminals for identity theft, or to aid in theplanning of criminal acts. Because of the threat of theft of PII, manyjurisdictions have passed legislation requiring the protection of PII.In addition, organizations are also motivated to protect private companyinformation that is sensitive to their business even if it is notclassified as PII.

SUMMARY

In one example embodiment, provided is a computing system that includesone or more of a processor that may receive a message transmitted from aclient device, the message including a predefined structural format forprocessing by a service providing computing system, determine a type ofthe message and detect one or more sensitive fields within the messagebased on the determined type of the message, and anonymize values of theone or more sensitive fields within the message while leaving thepredefined structural format intact, and a network interface that maytransmit the anonymized message including the one or more anonymizedvalues with the predefined structural format remaining intact to theservice providing computing system.

In another example embodiment, provided is a computer-implemented methodthat includes one or more of receiving a message transmitted from aclient device, the message including a predefined structural format forprocessing by a service providing computing system, determining a typeof the message and detecting one or more sensitive fields within themessage based on the determined type of the message, anonymizing valuesof the one or more sensitive fields within the message while leaving thepredefined structural format intact, and transmitting the anonymizedmessage including the one or more anonymized values with the predefinedstructural format remaining intact to the service providing computingsystem.

In another example embodiment, provided is a non-transitory computerreadable medium having stored therein program instructions that whenexecuted cause a computer to perform one or more of receiving a messagetransmitted from a client device, the message including a predefinedstructural format for processing by a service providing computingsystem, determining a type of the message and detecting one or moresensitive fields within the message based on the determined type of themessage, anonymizing values of the one or more sensitive fields withinthe message while leaving the predefined structural format intact, andtransmitting the anonymized message including the one or more anonymizedvalues with the predefined structural format remaining intact to theservice providing computing system.

In one example embodiment, provided is a computing system that includesone or more of a network interface that may receive an anonymizedmessage transmitted from a proxy system, the anonymized messageincluding a predefined structural format, anonymized values included inone or more sensitive data fields of the message, and non-identifyingvalues in remaining data fields of the message, and a processor that mayidentify data to be processed from the remaining data fields in themessage and execute a process on the identified data from the remainingdata fields without using the anonymous values included in the one ormore sensitive data fields to generate a processing result for theanonymized message, wherein the processor may further control thenetwork interface to transmit a response message to the proxy systembased on the generated processing result.

In another example embodiment, provided is a computer-implemented methodthat includes one or more of receiving an anonymized message transmittedfrom a proxy system, the anonymized message including a predefinedstructural format, anonymized values included in one or more sensitivedata fields of the message, and non-identifying values in remaining datafields of the message, identifying data to be processed from theremaining data fields in the message and executing a process on theidentified data from the remaining data fields without using theanonymous values included in the one or more sensitive data fields togenerate a processing result for the anonymized message, andtransmitting a response message to the proxy system based on thegenerated processing result.

Other features and modifications may be apparent from the followingdescription when taken in conjunction with the drawings and the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

For a proper understanding of the examples described herein, referenceshould be made to the enclosed figures. It should be appreciated thatthe figures depict only some embodiments and are not limiting of thescope of the present disclosure.

FIG. 1 is a diagram illustrating a sanitization system for a public hostplatform in accordance with an example embodiment.

FIG. 2 is a diagram illustrating a sanitization proxy communicating witha public cloud service in accordance with an example embodiment.

FIG. 3 is a diagram illustrating a process of anonymizing sensitiveclient data from a message in accordance with an example embodiment.

FIG. 4 is a diagram illustrating a method for sanitizing data inaccordance with an example embodiment.

FIG. 5 is a diagram illustrating a method for receiving and processingsanitized data in accordance with an example embodiment.

FIG. 6 is a diagram illustrating a computing system in accordance withan example embodiment.

DETAILED DESCRIPTION

It will be readily understood that the components of the presentapplication, as generally described and illustrated in the figuresherein, may be arranged and designed in a wide variety of differentconfigurations. Thus, the following detailed description of theembodiments of at least one of a method, apparatus, non-transitorycomputer readable medium and system, as represented in the attachedfigures, is not intended to limit the scope of the application asclaimed, but is merely representative of selected embodiments.

The features, structures, or characteristics as described throughoutthis specification may be combined in any suitable manner throughout theembodiments. In addition, the usage of the phrases such as “exampleembodiments”, “some embodiments”, or other similar language, throughoutthis specification is used to indicate that a particular feature,structure, or characteristic described in connection with the embodimentmay be included in the at least one embodiment and is not to beconstrued as being omitted from other embodiments. Thus, appearances ofthe phrases “example embodiments”, “in some embodiments”, “in otherembodiments”, or other similar language, may be used to refer to thesame group of embodiments, and the described features, structures, orcharacteristics may be combined in any suitable manner in one or moreembodiments.

In addition, while the term “message” may be used in the description ofembodiments, the application may be applied to many types of networkdata, such as, packet, frame, datagram, etc. The term “message” or“request” may include packet, frame, datagram, and any equivalentsthereof. Furthermore, while certain types of messages and signalingrequests may be depicted in example embodiments they are not limited toa certain type of message, and the application is not limited to acertain type of signaling.

The instant application relates a data sanitization system, and inparticular, to a proxy system of a private network that removessensitive personally identifying information from a message prior to themessage being delivered to a public cloud thereby enhancing the securityof personal information of users of the private network. In addition,the embodiments also provide a cloud service system that receives ananonymized message with anonymized data values in sensitive data fieldsand non-identifying values in remaining data fields. The cloud servicesystem can execute or otherwise run a service on client data from thenon-identifying values of the message and generate a processing result.Furthermore, the cloud service system can transmit a response message tothe proxy system based on the processing result. In this example, theresponse message may include the anonymized data values in the sensitivedata fields without having any personally identifiable information. Theproxy may use a key identifier that is embedded within the anonymizedsensitive data fields to decrypt the sensitive data, determine theclient, and transmit the processing result to a corresponding clientsystem.

In order to prevent fraud and other criminal activity, organizationsthat use third-party cloud services for data processing and storageshould make sure the data sent to the cloud is protected if it includesany PII or sensitive information. The example embodiments provide asystem for sanitizing sensitive or Personally Identifiable Information(PII) for data processing and storage in the public cloud and allowsorganizations to utilize third-party cloud services without the risk ofexposing sensitive data such as PII data.

Related systems may attempt to encrypt all client/message data beforesending the data to the cloud. This might be an acceptable solution ifcloud is only used for storing and/or sharing the data amongst theparties that have access to the decryption keys. However, it makes itimpossible for any third-party cloud services that do not have theencryption keys to decrypt the data and perform data operations.Furthermore, this procedure encrypts all of the data even if only asmall percentage of it contains or sensitive information, increasingprocessing overhead. Other related systems may maintain decryptionservers in the cloud or rely on the cloud service provider to protectthe data so they have access to the plaintext information forprocessing. However, these have the drawback of having to trust anotherentity to protect the PII or sensitive data during transfer, storage andprocessing and that the PII otherwise sensitive data can be decryptedand accessed outside of the organization to which it belongs.

The example embodiments are directed to a system that acts as a proxybetween the organization's personal data and third-party (e.g., public)cloud services and selectively anonymizes (e.g., encrypts, obscures,etc.) only the PII or sensitive information in the text or binary databefore it is sent to the cloud, without changing the structure of thedata message/fields. This allows the cloud service being used to processthe data correctly, without any risk of exposing the PII or sensitivedata. The system also allows for decrypting the data when results arereceived back from the cloud service and provides a way to regularlychange encryption keys to comply with best security practices, whilemaking sure data already stored encrypted with old keys in the cloud canstill be decrypted. Furthermore, the proxy may be part of a privatenetwork. Accordingly, plaintext PII and sensitive data and the keys usedto encrypt/decrypt the data may never leave the private enterprise,removing the risk of exposing sensitive or PII data while using publiccloud.

FIG. 1 illustrates a sanitization system 100 for a public host platformin accordance with an example embodiment. Referring to FIG. 1, thesystem 100 includes a plurality of client devices 110 which may be partof a private network (e.g., enterprise resource network, etc.), a proxysystem 120, and a plurality of host servers 130 that host publicservices such as cloud-based public services for performing dataprocessing and operations on the public cloud. According to variousaspects, the proxy system 120 (e.g., local network server) may also bepart of the private network including the client devices 110, however,embodiments are not limited thereto. During a communication processbetween a client device 110 and a host server 130, the proxy system 120may intercept or otherwise receive a message transmitted by the clientdevice 110 and intended for the host server 130, and sanitize themessage to remove or otherwise anonymize sensitive client information.As a result, the message the is ultimately sent to the host server 130may be completely anonymous to the host server 130. In the example ofFIG. 1, one proxy system 120 is shown. However, it should be appreciatedthat the system 100 may include multiple proxy systems 120 (e.g., atdifferent local servers of the private network) to serve differentsegments of client devices 110 on the private network.

According to various embodiments, the proxy system 120 anonymizessensitive data from the client by performing an encryption of a value ofthe data field resulting in an encrypted data value for the sensitivedata field. Furthermore, the proxy system 120 may add a key identifierof the encryption key used to the encrypted data value (or somewhereelse in the message) prior to transmitting the message to the hostservice 130. The host server 130 may execute a third party service onthe non-identifying data included in the message without using theanonymous data, and generate a processing result. Furthermore, the hostserver 130 may transmit a response message back to the proxy system 120based on the processing result. The response message may include theanonymous data values in the sensitive data fields.

In response, the proxy system 120 can decrypt the encrypted fieldsreturned from the cloud service hosted by host server 130 based on thekey identifier. The key identifier may be a unique private identifierfor the encryption key used to encrypt the data that is included withthe data sent to the cloud. The key identifier is used by the system tolocate the decryption key needed to decrypt the data received back fromthe cloud service but does not include any information for a third partyto reconstruct the decryption key. The key identifier may be appended orotherwise added to the message field encrypted by the proxy system 120before the proxy system 120 sends the data to the cloud. If any of thefields in the processing results received back from the cloud servicehost server 130 includes a key identifier, the proxy system 120 maydeduce that the field contains data that it had encrypted, locates thecorrect decryption key using the key identifier, and decrypts the fieldbefore forwarding the results to the corresponding client device 110that is accessing the cloud service.

The use of the proxy system 120 allows for easily changing theencryption keys used for new data, while making sure data already storedin the cloud with the old keys can still be decrypted even if the cloudservice used does not allow updating the data once it is stored. In thisexample, a new key identifier may be appended to the newly encrypteddata while older data received from the service is decrypted with theold keys that are located by their key identifier. The old keys can bestored on the proxy system 120 until the end of the data retentionperiod of the cloud service being used. If the cloud service that willprocess or analyze the data is expecting structured data with apre-determined format for the fields that need to beencrypted/sanitized, then a field format preserving encryption algorithmis used. In this case, the key identifier is appended as an extra fieldor an existing field that's not processed by the cloud service beingused is replaced with the key identifier.

FIG. 2 a sanitization proxy communicating with a public cloud service inaccordance with an example embodiment. In this example, client data isintercepted by the proxy system 210 (which corresponds to the proxysystem 120 in FIG. 1). The proxy system 210 in this example includes anencoder/decoder module 211, a parser 212, a encryption/decryption module213, and a secure key store 214 that stores encryption keys and a lookuptable for key identifiers. The proxy system 210 is not limited tosanitizing text formats such as text documents, HTML, XML, JSON, logdata, events, etc. It also supports sanitizing binary formats such asvarious document formats and NetFlow/IPFIX flow data via the help ofcustomized encoder/decoder modules.

According to various aspects, the proxy system 210 may determine a datatype of the message, invoke the corresponding decoder 211 and pass thedecoded data to the parser 212 to identify the PII and/or othersensitive data fields for encryption. The sensitive data fields withinthe message are then encrypted by the encryption/decryption module 213and then re-encoded in the original format by the encoder module 211 andforwarded to the cloud service. The forwarded data is completelyanonymous to the cloud service 220, however, the data message has apredefined structural format that remains intact thereby allowing thecloud service 220 to execute a software process on the remaining data(i.e., the non-identifying data) that remains the anonymous message. Forexample, the cloud service 220 may include a processor 222 that executesone or more programs/services stored in storage 224 on the anonymousmessage data.

Furthermore, based on the processing result, the cloud service 220generates a response message which includes the same anonymous datawithin the sensitive data fields and transmits the response message tothe proxy system 210. A similar process is followed by the proxy system210 for the data received from the cloud service 220 for decoding,decrypting and re-encoding the decrypted data. The proxy system 210 mayprovide built-in encoder/decoders for common binary formats as well asthe ability to plugin custom encoder/decoders. Furthermore, because theproxy system 210 stores key identifiers in the secure key storage 214,the proxy system 210 can detect a message field that includes a keyidentifier, and decrypt the message field based on a decryption keylinked to the key identifier thereby revealing the personallyidentifiable information of the client system. Accordingly, the proxysystem 210 may forward the processing result to the corresponding clientsystem.

In some cases, the data sanitization proxy system may be available toclients on the enterprise network, only. Clients accessing the cloudservices outside of the enterprise network, for example on a mobiledevice while travelling, can still use the cloud service but will onlybe able to see encrypted values for the PII and sensitive data fields.The plaintext PII and sensitive data and the keys used toencrypt/decrypt them never leave the private enterprise. This may beused to ensure PII and sensitive data are not exposed to a publicnetwork or service while allowing the use of a public service to processthe data containing the PII or sensitive data.

Which fields are considered PII/sensitive can be configurable by thesanitization proxy admin and can also include data that's not consideredPII but the organization considers sensitive. Examples of sensitiveinformation include social security numbers, employee names, employeephone numbers, internal IP addresses, etc. Furthermore, the sensitiveinformation may be different based on a type of cloud service beingperformed by the cloud service 220. Non-limiting examples of cloudservices include cloud security brokers, cloud security log analyzers,cloud log archivers, cloud statistical data analyzers, cloud storageservices, and the like. The client data being sanitized can be in anyformat including JSON, text, xml, csv, syslog, windows security eventlogs, custom format, etc. The sanitization proxy system 210 does notneed to understand the format of the data it is processing. In addition,data transfer between the client, the proxy system 210, and the cloudservice 220, can be in HTTP/HTTPS protocol (web requests) as that's theprotocol used by most cloud services.

To generate the sensitive data fields, the proxy administrator mayconfigure regular expressions or other information that identify type ofmessages that may contain sensitive data and configures the regularexpressions that match the PII/sensitive fields within each type ofmessage. As the data is coming in from the client, the proxy system 210may recognize the message types that need to be processed using theconfiguration. The proxy 210 can then apply the regular expressions thatwere configured for that type of message and replace only the matchingsensitive fields without changing the format of the data and forwardsthe message to the cloud service 220. In some embodiments, the proxysystem 210 may come with default regular expressions already built-infor common PII fields such as phone numbers, social security numbers,etc. but the administrator can define their own regular expressions forany other type of data they want sanitized.

FIG. 3 illustrates a sanitization process of anonymizing sensitiveclient data from a message in accordance with an example embodiment. Inthis example, an event log message 300A is received from a clientdevice, and the proxy system generates an anonymous message 300B with apredefined structural format of the event log message remaining intact.In particular, the proxy system encrypts values of sensitive data fieldsincluding user name, target domain, and network address, and inserts theencrypted values into the anonymous message 300B. In addition, the proxyadds a key identifier 311 to an end of an encrypted value for eachsensitive data field within the field. However, the embodiments are notlimited thereto, and the key identifier may be inserted elsewhere in themessage such as a header or a field that is not being used for this typeof service.

For example, an organization may want to use a cloud security broker ora security log analyzer to analyze their internal logs for any evidenceof intrusions or suspicious activities. The organization may haveWINDOWS® and LINUX® devices that generate logs in a WINDOWS® securitylog format and a LINUX® syslog format. Hence, the organization maychoose a cloud log analyzer cloud service that supports these formats.The organization may configure the internal log collector devices tosend the logs to the cloud service but they want to make sure the PIIand sensitive data within the logs are not sent to the cloud.Accordingly, the sanitization proxy system can be configured tointercept the data being sent to the cloud log analyzer and sanitize itbefore forwarding it on.

For example, the sanitization system intercepts a Windows security eventlog message 300A as shown in FIG. 3. Here, the sanitization system isconfigured to recognize WINDOWS® security event logs and LINUX® sysloglogs. The proxy system may identify the message as a security event logmessage using its configuration. The proxy system may then check what itneeds to do with this type of message. The proxy administrator hasconfigured to sanitize the user name, target domain and the sourcenetwork address fields from the security event log messages usingregular expressions that identify these fields. The sanitization systemencrypts these fields without changing the format of the originalmessage so that the cloud log analyzer can still recognize it as asecurity event log and process it. The proxy converts the message 300Ainto an anonymous message 300B. However, the structure of the originalmessage is left intact but the sensitive fields are replaced. Forexample, the employee name john.doe is replaced with an encrypted/hashand a key identifier PK789 is of the encryption key used is added to anend of the encrypted value.

When the cloud service generates a processing result, it can respondwith a message including information about the processing result as wellas hash/encrypted values similar included in the anonymous message 300B.The sanitization proxy may intercept this response from the cloudservice, and detect the fields that it has encrypted, locates theencryption key PK789 in its lookup table, decrypts and replaces thefields without changing the data structure and forwards the message toits destination client.

Although not shown in FIG. 3, in some examples, the cloud service beingused may check the length of a field or format of a field. In thisexample, the sanitization proxy can be configured to use aformat-preserving encryption. For example, if the cloud log analyzerexpects the value of the “Source Network Address” field to be in IPAddress format, then the sanitization proxy admin can configure thesystem to use a format-preserving replacement for that field andstandard encryption replacement for the other fields. The fields thatrequire format preservation are encrypted using format-preservingencryption algorithms and the key identifier of the key can be insertedinto an unused field or appended to the message as a new field. This isalso configurable by the proxy admin.

Different encryption keys may be used by the proxy system for differentcloud services. For example, if the organization is using a cloud loganalyzer service and another statistical analyzer service, differentkeys may be used for each service even if the same data is being sent toboth services. Also, for the messages sent to a single cloud service,the key usage is configurable. All fields within the messages can usethe same key or certain fields can be configured to use different keys.However, all fields of one type may use the same key if correlationbetween different messages is required. In the example above, all username fields are encrypted with key PK789 but all source network addressfields can be encrypted with PK790. The log analyzer service may report“Too many login attempts” for user “john.doe” after it sees many logmessages with the same user name within a given time period. For this towork, all user name fields may be encrypted with the same key for thegiven period. Also, new keys can be generated for each cloud service atthe proxy administrator's discretion. Old keys may be stored for theperiod configured by the administrator to allow old data to bedecrypted.

FIG. 4 illustrates a method 400 a method for sanitizing data inaccordance with an example embodiment. For example, the method 400 maybe performed by a proxy system such as the proxy system 120 shown inFIG. 1. Also, the method 400 may be performed by a computing device suchas a server, a user device, a cloud platform, or the like. The method400 may be used to obscure, remove, or otherwise hide sensitiveinformation such as PII that is capable of identifying a user, a userdevice, or the like. In 410, the method may include receiving a messagetransmitted from a client device. For example, the message may have apredefined structural format used by a cloud service or other publicservice that processes client data included in the message. For example,the cloud service may be an enterprise resource function or the likethat operates on client data from an enterprise resource network.Services may include inventory management, purchasing, finance, humanresources, and the like. However, the embodiments are not limited toenterprise resource services and may be used with any third partyservices and functions.

In 420, the method may include determining a type of the message anddetecting one or more sensitive fields within the message based on thedetermined type of the message. For example, the message type may bedetermined based on a cloud service that the message is destined forfrom among a plurality of cloud services. Each service may use differentdata fields within the message based on the functions that are performedby the service. Therefore, different PII may be included in the messagereceived from the client device based on the service being performed.The detecting performed in 420 may identify different PII fields withina body or an interior of the message based on a type of the service tobe performed.

In 430, the method may include anonymizing values of the one or moresensitive fields within the message while leaving the predefinedstructural format intact, and in 440, transmitting the anonymizedmessage including the one or more anonymized sensitive fields with thepredefined structural format remaining intact to the service providingcomputing system. For example, the anonymizing may include encrypting orotherwise obscuring the PII values within the interior of the messagewhile leaving values of remaining fields (i.e. that do not include PII)within the body of the message intact. The anonymizing may includeencrypting a value of a sensitive field using an encryption key andadding a key identifier of the encryption key to the body of themessage.

According to various aspect, the proxy system may add (e.g., append,postpend, etc.) a value of the key identifier (e.g., an alphanumericvalue) to an encrypted value that is stored within the sensitive datafield of the message. In order to keep track of the key identifiers, theproxy system may store a lookup table including key identifiers andcorresponding encryption keys of each key identifier, in a storagedevice. Accordingly, the data may leave the proxy system beingcompletely anonymized with the only identifying information being thekey identifier of the encryption key (which is only known to the proxysystem). Accordingly, the message data may be accessed and analyzed by athird party such as a public cloud service without divulging personallyidentifiable information of a client.

Although not shown in FIG. 4, in some embodiments the method may furtherinclude receiving a response message from the service providingcomputing system that includes a processing result of the serviceproviding computing system and the one or more anonymized sensitive datafields. In response, the method may include decrypting the one or moreanonymized sensitive data fields, determining that the client device isassociated with the processing result based on the decrypted sensitivedata fields, and transmitting the processing result to the clientdevice. For example, the method may refer to the lookup table includingthe correlation between key identifiers and encryption keys.

FIG. 5 illustrates a method 500 for receiving and processing sanitizeddata in accordance with an example embodiment. For example, the method500 may be performed by a public cloud service host such as a hostplatform 130 shown in FIG. 1. Also, the method 500 may be performed by acomputing device such as a server, a user device, a cloud platform, orthe like. Referring to FIG. 5, in 510, the method may include receivingan anonymized message transmitted from a proxy system. For example, theanonymized message may have a predefined structural format forprocessing by a cloud service and may include anonymous data that hasbeen substituted into one or more sensitive fields of the message andnon-identifying client data values in other remaining fields. Inaddition, the message may also include client data for processing suchas via a public cloud service or other third party application.

For example, the one or more sensitive fields with anonymous data mayeach include an encrypted value that is encrypted using an encryptionkey. Different message fields may be encrypted using different keys bythe proxy system. The encryption keys may be unknown to the serviceprocessing system. In addition, the message may include a key identifierfor each field that has been encrypted. The key identifier may identifythe encryption key used by the proxy system. According to variousaspects, the one or more sensitive fields with the anonymous data eachcorrespond to personally identifiable information (PII) of a clientdevice.

In 520, the method may include identifying data to be processed from theremaining fields of data of the message and executing a process on theidentified data from the remaining fields without using the anonymousdata to generate a processing result. For example, the processing mayexecute a public cloud service such as an ERP service or the like ondata included within the message. In 530, the method may includegenerating and transmitting a response message including the processingresult and including the one or more sensitive fields with anonymousdata, to the proxy system.

The above embodiments may be implemented in hardware, in a computerprogram executed by a processor, in firmware, or in a combination. Acomputer program may be embodied on a computer readable medium, such asa storage medium. For example, a computer program may reside in randomaccess memory (“RAM”), flash memory, read-only memory (“ROM”), erasableprogrammable read-only memory (“EPROM”), electrically erasableprogrammable read-only memory (“EEPROM”), registers, hard disk, aremovable disk, a compact disk read-only memory (“CD-ROM”), or any otherform of storage medium known in the art.

An exemplary storage medium may be coupled to the processor such thatthe processor may read information from, and write information to, thestorage medium. In the alternative, the storage medium may be integralto the processor. The processor and the storage medium may reside in anapplication specific integrated circuit (“ASIC”). In the alternative,the processor and the storage medium may reside as discrete components.For example, FIG. 6 illustrates an example computer system architecture600, which may represent or be integrated in any of the above-describedcomponents, etc. The computer system 600 may be a single device or acombination of devices. For example, the computer system 600 may be ablockchain node, a database, a server, a cloud platform, a network, acombination thereof, and the like.

FIG. 6 is not intended to suggest any limitation as to the scope of useor functionality of embodiments of the application described herein.Regardless, the computing system 600 (or node 600) is capable of beingimplemented and/or performing any of the functionality set forthhereinabove.

In computing node 600 there is a computer system/server 602, which isoperational with numerous other general purpose or special purposecomputing system environments or configurations. Examples of well-knowncomputing systems, environments, and/or configurations that may besuitable for use with computer system/server 602 include, but are notlimited to, personal computer systems, server computer systems, thinclients, thick clients, hand-held or laptop devices, multiprocessorsystems, microprocessor-based systems, set top boxes, programmableconsumer electronics, network PCs, minicomputer systems, mainframecomputer systems, and distributed cloud computing environments thatinclude any of the above systems or devices, and the like.

Computer system/server 602 may be described in the general context ofcomputer system-executable instructions, such as program modules, beingexecuted by a computer system. Generally, program modules may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system/server 602 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program modules may be locatedin both local and remote computer system storage media including memorystorage devices.

As shown in FIG. 6, computer system/server 602 in computing node 600 isshown in the form of a general-purpose computing device. The componentsof computer system/server 602 may include, but are not limited to, oneor more processors or processing units 604 (i.e., processors), a systemmemory 606, and a bus that couples various system components includingsystem memory 606 to processor 604. The computing node 600 may be theproxy system 120 shown in FIG. 1, the host system 130 shown in FIG. 1,or another device or combination of devices such as a server, cloudplatform, database, user device and/or the like. Also, the computingnode 600 may perform each of the method 400 shown in FIG. 4 and/or themethod 500 shown in FIG. 5.

The bus represents one or more of any of several types of busstructures, including a memory bus or memory controller, a peripheralbus, an accelerated graphics port, and a processor or local bus usingany of a variety of bus architectures. By way of example, and notlimitation, such architectures include Industry Standard Architecture(ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA)bus, Video Electronics Standards Association (VESA) local bus, andPeripheral Component Interconnects (PCI) bus.

Computer system/server 602 typically includes a variety of computersystem readable media. Such media may be any available media that isaccessible by computer system/server 602, and it includes both volatileand non-volatile media, removable and non-removable media. System memory606, in one embodiment, implements the flow diagrams of the otherfigures. The system memory 606 can include computer system readablemedia in the form of volatile memory, such as random access memory (RAM)610 and/or cache memory 612. Computer system/server 602 may furtherinclude other removable/non-removable, volatile/non-volatile computersystem storage media. By way of example only, storage system 614 can beprovided for reading from and writing to a non-removable, non-volatilemagnetic media (not shown and typically called a “hard drive”). Althoughnot shown, a magnetic disk drive for reading from and writing to aremovable, non-volatile magnetic disk (e.g., a “floppy disk”), and anoptical disk drive for reading from or writing to a removable,non-volatile optical disk such as a CD-ROM, DVD-ROM or other opticalmedia can be provided. In such instances, each can be connected to thebus by one or more data media interfaces. As will be further depictedand described below, memory 606 may include at least one program producthaving a set (e.g., at least one) of program modules that are configuredto carry out the functions of various embodiments of the application.

Program/utility 616, having a set (at least one) of program modules 618,may be stored in memory 606 by way of example, and not limitation, aswell as an operating system, one or more application programs, otherprogram modules, and program data. Each of the operating system, one ormore application programs, other program modules, and program data orsome combination thereof, may include an implementation of a networkingenvironment. Program modules 618 generally carry out the functionsand/or methodologies of various embodiments of the application asdescribed herein.

As will be appreciated by one skilled in the art, aspects of the presentapplication may be embodied as a system, method, or computer programproduct. Accordingly, aspects of the present application may take theform of an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present application may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Computer system/server 602 may also communicate with one or moreexternal devices 620 such as a keyboard, a pointing device, a display622, etc.; one or more devices that enable a user to interact withcomputer system/server 602; and/or any devices (e.g., network card,modem, etc.) that enable computer system/server 602 to communicate withone or more other computing devices. Such communication can occur viaI/O interfaces 624. Still yet, computer system/server 602 cancommunicate with one or more networks such as a local area network(LAN), a general wide area network (WAN), and/or a public network (e.g.,the Internet) via network adapter 626 (also referred to as a networkinterface). As depicted, network adapter 626 communicates with the othercomponents of computer system/server 602 via a bus. It should beunderstood that although not shown, other hardware and/or softwarecomponents could be used in conjunction with computer system/server 602.Examples, include, but are not limited to: microcode, device drivers,redundant processing units, external disk drive arrays, RAID systems,tape drives, and data archival storage systems, etc.

According to various embodiments, the processor 604 may receive amessage transmitted from a client device. The message may be transmittedfrom a client device that is connected to the computing system 602 via anetwork (e.g., network interface 626). The network may be a localnetwork, a private network, an enterprise resource network, a publicnetwork, or the like. The message may include a predefined structuralformat defined by specific fields which are used for processing by aservice providing computing system such as a public cloud service.Depending on the cloud service to be used, the message may havedifferent fields of sensitive information (e.g., PII, internalorganization information, etc.) filled out. The processor 606 maydetermine a type of the message and detect one or more sensitive fieldswithin the message based on the determined type of the message.Furthermore, the processor 606 may anonymize values of the one or moresensitive fields within the message while leaving the predefinedstructural format intact to generate an anonymized message. The networkinterface 626 may transmit the anonymized message to the serviceproviding computing system.

In some embodiments, the processor 606 may manage a lookup table storedin the storage 604 which includes a linkage between key identifiers andcorresponding encryption keys of each key identifier. When the computingsystem 602 transmits the anonymized message to the cloud service, theanonymized message does not have any identifying information thatidentifies a client or a client device that transmitted the message.Here, the proxy may completely anonymize (e.g., encrypt PII) the data ofthe message. To enable the proxy can decrypt the message when a responseis returned from the cloud service, the processor 606 may embed orotherwise add a key identifier to the encrypted data value included inthe message field. This key identifier may not mean anything to thecloud service but can be used by the proxy system to decrypt the PIIwhen a response message including the encrypted values is returned.Furthermore, the proxy system can deliver the processing result messageto the client device based on the decrypted PII.

According to various other embodiments, the computing system maycorrespond to a host server of a public cloud service. In this example,the network interface 626 may receive an anonymized message transmittedfrom a proxy system. For example, the anonymized message may include apredefined structural format, anonymized values included in one or moresensitive data fields of the message, and non-identifying values inremaining data fields of the message. The processor 604 may identifydata to be processed from the remaining data fields in the message andexecute a process on the identified data from the remaining data fieldswithout using the anonymous values included in the one or more sensitivedata fields to generate a processing result for the anonymized message.Furthermore, the network interface 626 may transmit a response messageto the proxy system based on the generated processing result.

Although an exemplary embodiment of at least one of a system, method,and non-transitory computer readable medium has been illustrated in theaccompanied drawings and described in the foregoing detaileddescription, it will be understood that the application is not limitedto the embodiments disclosed, but is capable of numerous rearrangements,modifications, and substitutions as set forth and defined by thefollowing claims. For example, the capabilities of the system of thevarious figures can be performed by one or more of the modules orcomponents described herein or in a distributed architecture and mayinclude a transmitter, receiver or pair of both. For example, all orpart of the functionality performed by the individual modules, may beperformed by one or more of these modules. Further, the functionalitydescribed herein may be performed at various times and in relation tovarious events, internal or external to the modules or components. Also,the information sent between various modules can be sent between themodules via at least one of: a data network, the Internet, a voicenetwork, an Internet Protocol network, a wireless device, a wired deviceand/or via plurality of protocols. Also, the messages sent or receivedby any of the modules may be sent or received directly and/or via one ormore of the other modules.

One skilled in the art will appreciate that a “system” could be embodiedas a personal computer, a server, a console, a personal digitalassistant (PDA), a cell phone, a tablet computing device, a smartphoneor any other suitable computing device, or combination of devices.Presenting the above-described functions as being performed by a“system” is not intended to limit the scope of the present applicationin any way, but is intended to provide one example of many embodiments.Indeed, methods, systems and apparatuses disclosed herein may beimplemented in localized and distributed forms consistent with computingtechnology.

It should be noted that some of the system features described in thisspecification have been presented as modules, in order to moreparticularly emphasize their implementation independence. For example, amodule may be implemented as a hardware circuit comprising custom verylarge scale integration (VLSI) circuits or gate arrays, off-the-shelfsemiconductors such as logic chips, transistors, or other discretecomponents. A module may also be implemented in programmable hardwaredevices such as field programmable gate arrays, programmable arraylogic, programmable logic devices, graphics processing units, or thelike.

A module may also be at least partially implemented in software forexecution by various types of processors. An identified unit ofexecutable code may, for instance, comprise one or more physical orlogical blocks of computer instructions that may, for instance, beorganized as an object, procedure, or function. Nevertheless, theexecutables of an identified module need not be physically locatedtogether, but may comprise disparate instructions stored in differentlocations which, when joined logically together, comprise the module andachieve the stated purpose for the module. Further, modules may bestored on a computer-readable medium, which may be, for instance, a harddisk drive, flash device, random access memory (RAM), tape, or any othersuch medium used to store data.

Indeed, a module of executable code could be a single instruction, ormany instructions, and may even be distributed over several differentcode segments, among different programs, and across several memorydevices. Similarly, operational data may be identified and illustratedherein within modules, and may be embodied in any suitable form andorganized within any suitable type of data structure. The operationaldata may be collected as a single data set, or may be distributed overdifferent locations including over different storage devices, and mayexist, at least partially, merely as electronic signals on a system ornetwork.

It will be readily understood that the components of the application, asgenerally described and illustrated in the figures herein, may bearranged and designed in a wide variety of different configurations.Thus, the detailed description of the embodiments is not intended tolimit the scope of the application as claimed, but is merelyrepresentative of selected embodiments of the application.

One having ordinary skill in the art will readily understand that theabove may be practiced with steps in a different order, and/or withhardware elements in configurations that are different than those whichare disclosed. Therefore, although the application has been describedbased upon these preferred embodiments, it would be apparent to those ofskill in the art that certain modifications, variations, and alternativeconstructions would be apparent.

The invention claimed is:
 1. A computing system comprising: a processorconfigured to receive a message transmitted from a client device, themessage comprising a plurality of predefined fields for processing by aservice providing computing system, encrypt values of one or morepersonally-identifying fields among the plurality of predefined fieldswithin the message based on an encryption key, insert the encryptedvalues in place of the values inside the personally-identifying fieldswhile leaving values of remaining non-identifying fields among theplurality of predefined fields within the message unchanged to generatean anonymized message with its service data payload intact, and insert akey identifier of the encryption key into a personally-identifying fieldof the anonymized message having an encrypted value therein; and anetwork interface configured to transmit the anonymized message with itsservice data payload intact to the service providing computing systemand receive an anonymized response message including a processingresult, wherein the processor is further configured to decrypt anencrypted value in the response message using a decryption keyidentified based on the previously inserted key identifier, determinethat the client device is associated with the processing result based onthe decrypted value, and transmit the processing result to the clientdevice.
 2. The computing system of claim 1, wherein the processor isconfigured to detect one or more fields within a body of the messagethat contain personally identifiable information (PII) values andencrypt the PII values while leaving values of remaining fields withinthe body intact to generate the anonymized message.
 3. The computingsystem of claim 1, wherein the key identifier comprises an alphanumericvalue and the processor is configured to sequentially append a firstcharacter of the alphanumeric value of the key identifier to a lastcharacter of an encrypted value inside a personally-identifying field ofthe anonymized message.
 4. The computing system of claim 1, wherein theprocessor is further configured to store a lookup table including keyidentifiers and corresponding encryption keys of each key identifier, ina storage device.
 5. The computing system of claim 1, wherein theresponse message includes a processing result generated by the serviceproviding computing system and the one or more encrypted values insertedinto the transmitted anonymized message.
 6. The computing system ofclaim 1, wherein the key identifier inserted within the anonymizedmessage is configured to locate the decryption key for decrypting theone or more encrypted values in a look-up table.
 7. The computing systemof claim 1, wherein the anonymous response message includes the one ormore encrypted values, the key identifier, and processed informationgenerated by processing non-sensitive data included in the anonymizedmessage.
 8. A computer-implemented method, comprising: receiving amessage transmitted from a client device, the message comprising aplurality of predefined fields for processing by a service providingcomputing system; encrypting values of one or morepersonally-identifying fields among the plurality of predefined fieldswithin the message based on an encryption key and inserting theencrypted values in place of the values inside thepersonally-identifying fields while leaving values of remainingnon-identifying fields among the plurality of predefined fields withinthe message unchanged to generate an anonymized message with its servicedata payload intact; inserting a key identifier of the encryption keyinto a personally-identifying field of the anonymized message having anencrypted value therein; and transmitting the anonymized message withits service data payload intact to the service providing computingsystem and receiving an anonymized response message including aprocessing result, wherein the method further comprises decrypting anencrypted value from the response message using a decryption keyidentified based on the previously inserted key identifier, determiningthat the client device is associated with the processing result based onthe decrypted value, and transmitting the processing result to theclient device.
 9. The computer-implemented method of claim 8, whereinthe detecting comprises detecting, by a proxy system, one or more fieldswithin a body of the message that contain personally identifiableinformation (PII) values, and encrypting, by the proxy system, the PIIvalues while leaving values of remaining fields within the body intactto generate the anonymized message.
 10. The computer-implemented methodof claim 8, wherein the key identifier comprises an alphanumeric valueand the inserting comprises sequentially appending a first character ofthe alphanumeric value of the key identifier to a last character of anencrypted value inside a personally-identifying field of the anonymizedmessage.
 11. The computer-implemented method of claim 8, wherein themethod further comprises storing a lookup table including keyidentifiers and corresponding encryption keys of each key identifier, ina storage device.
 12. The computer-implemented method of claim 8,wherein the response message includes a processing result generated bythe service providing computing system and the one or more encryptedvalues inserted into the transmitted anonymized message.
 13. The methodof claim 8, wherein the key identifier inserted within the anonymizedmessage is configured to locate the decryption key for decrypting theone or more encrypted values in a look-up table.
 14. The method of claim8, wherein the anonymous response message includes the one or moreencrypted values, the key identifier, and processed informationgenerated by processing non-sensitive data included in the anonymizedmessage.
 15. A non-transitory computer readable medium having storedtherein program instructions that when executed cause a computer toperform a method comprising: receiving a message transmitted from aclient device, the message comprising a plurality of predefined fieldsfor processing by a service providing computing system; encryptingvalues of one or more personally-identifying fields among the pluralityof predefined fields within the message based on an encryption key andinserting the encrypted values in place of the values inside thepersonally-identifying fields while leaving values of remainingnon-identifying fields among the plurality of predefined fields withinthe message unchanged to generate an anonymized message with its servicedata payload intact; inserting a key identifier of the encryption keyinto a personally-identifying field of the anonymized message having anencrypted value therein; and transmitting the anonymized message withits service data payload intact to the service providing computingsystem and receiving an anonymized response message including aprocessing result, wherein the method further comprises decrypting anencrypted value from the response message using a decryption keyidentified based on the previously inserted key identifier, determiningthat the client device is associated with the processing result based onthe decrypted value, and transmitting the processing result to theclient device.
 16. The non-transitory computer readable medium of claim15, wherein the detecting comprises detecting, by a proxy system, one ormore fields within a body of the message that contain personallyidentifiable information (PII) values, and encrypting, by the proxysystem, the PII values while leaving values of remaining fields withinthe body intact to generate the anonymized message.
 17. Thenon-transitory computer readable medium of claim 15, wherein the keyidentifier comprises an alphanumeric value and the inserting comprisessequentially appending a first character of the alphanumeric value ofthe key identifier to a last character of an encrypted value inside apersonally-identifying field of the anonymized message.
 18. Thenon-transitory computer readable medium of claim 15, wherein the methodfurther comprises storing a lookup table including key identifiers andcorresponding encryption keys of each key identifier, in a storagedevice.
 19. The non-transitory computer readable medium of claim 15,wherein the response message includes a processing result generated bythe service providing computing system and the one or more encryptedvalues inserted into the transmitted anonymized message.
 20. Thenon-transitory computer readable medium of claim 15, wherein the keyidentifier inserted within the anonymized message is configured tolocate the decryption key for decrypting the one or more encryptedvalues in a look-up table.
 21. The non-transitory computer readablemedium of claim 15, wherein the anonymous response message includes theone or more encrypted values, the key identifier, and processedinformation generated by processing non-sensitive data included in theanonymized message.